The PHP security team released emergency updates on Wednesday to fix two critical vulnerabilities that could let attackers take over web servers remotely without logging in.
The issues, CVE-2026-109618 and CVE-2026-109619, affect the programming language that powers many websites. One involves how the software handles a server running out of memory, while the other involves leftover data.
The PHP team said there are "no complete mitigations" and urged all users to update "immediately." The fixes are in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Linux vendors received the patches ahead of the public release, while other users can get the fix through their normal package updates.
No comments:
Post a Comment
Note: Only a member of this blog may post a comment.